sepostgresql/sepostgresql.8

.TH "sepostgresql" "8" "Jul 15 2007" "kaigai@kaigai.gr.jp" "Security-Enhanced PostgreSQL"

.SH "NAME"
sepostgresql \- Security-Enhances PostgreSQL

.SH "DESCRIPTION"
Security-Enhanced PostgreSQL (SE-PostgreSQL) is an enhancement of PostgreSQL,
to apply fine grained mandatory access control for database objects based on
the security policy of SELinux. 
These features enable to apply flexible integrated access control policy
on both of operating system and database management system, during all
stages of the life of the information.
.PP
This document describes the way to customize SE-PostgreSQL on the default
security policy.

.SH "BOOLEANS"
The SELinux policy is customizable via BOOLEAN variable. This variable has
two states, 1 (on) or 0 (off). We can validate or invalidate a part of the
security policy depending on the state of boolean variables.

\fBsepgsql_enable_users_ddl\fP enables to toggle permissions of confined
users/applications to invoke DDL statement, like CREATE TABLE. It is set to
\fBon\fP in the default.
In most cases, DDL statements are used to set up initial database structure,
and permissions to invoke them are not necessary on operation phase.
You can turn off this boolean as follows:

.EX
setsebool -P sepgsql_enable_users_ddl ( \fBon\fP | off )
.EE

Rest of booleans are provided by \fBselinux-devel.pp\fP policy module.
It provides developments/debugs related permissions.
You can install it as follows:

.EX
semodule -i /usr/share/selinux/targeted/sepostgresql-devel.pp
.EE

\fBsepgsql_enable_auditallow\fP toggles output of audit messages in the case
when required permission checks are allowed, except for tuples because it
easily make a flood of audit logs.
In the default, it is set to off. You can set it as follows:

.EX
setsebool -P sepgsql_enable_auditallow ( on | \fBoff\fP )
.EE

\fBsepgsql_enable_auditdeny\fP toggles output of audit messages in the case
when required permission checks are denied, except for tuples because it
easily make a flood of audit logs.
In the default, it is set to on. You can set it as follows:

.EX
setsebool -P sepgsql_enable_auditdeny ( \fBon\fP | off )
.EE

\fBsepgsql_regression_test_mode\fP allows to load shared libraries deployed
on user's home directory. We recommend you to keep \fBoff\fP in operation
phase to prevent to load malicious libraries.
However, typical PostgreSQL regression test requires to load it, so we
have to reduce several restriction during the test.
In the default, it is set to off. You can set it as follows:

.EX
setsebool -P sepgsql_regression_test_mode ( on | \fBoff\fP )
.EE

.SH "TYPES"

\fBsepgsql_db_t\fP is a only type for database itself.
It is attched for newly created databases in the default.

\fBsepgsql_table_t\fP is a type for tables, columns and tuples.
It is the default type of newly created tables by unconfined or
non-roled domain. It allows confined clietns to access with any
kind of operations except for relabeling, so we can use this type
for compatible purpose.

\fBsepgsql_secret_table_t\fP is a type for tables, columns and tuples.
It never allows confined clients to access, so we can use this type
to store sensitive information. We reccomend to apply trusted procedures
to access tables/columns/tuples with this type under safe operation.

\fBsepgsql_ro_table_t\fP is a type for read-only tables, columns and tuples.
It does not allow confined clients to modify any objects with this type.

\fBsepgsql_fixed_table_t\fP is a type for non-manupulatable tables, columns
and tuples. It does not allow confined clients to update or delete any
objects with this type.

\fBsepgsql_ROLE_table_t\fP is a type for a role specific tables, columns
and tuples. It allows confined clients with its role to access with any
kind of operations except for relabeling.
It is the default type of newly created tables by confined clients with
its role, and we can use this type to describe role level separation.

\fBsepgsql_proc_t\fP is a type for procedures.
It is attached for newly created procedures by unconfined clients.
It allows any clients to invoke procedures with this type.
All of PostgreSQL built-in functions are labeled as this type in the default.

\fBsepgsql_ROLE_proc_t\fP is a type for a role specific procedure.
It is attached for newly created procedures by confined clients with its role.
It allows clients with same role to invoke procedure with this type.
Note that unconfined clients cannot invoke this type to avoid to execute
dangerous functions with unconfined authorities. They have to confirm its
contains and relabel to \fBsepgsql_proc_t\fP for its invocation.

\fBsepgsql_trusted_proc_exec_t\fP is a type for trusted procedures.
To call procedures with this type invokes domain transition to
unconfined domain, so it can access any kind of database objects.
We can use this type to provide a secure method to access sensitive
information.

\fBsepgsql_blob_t\fP is a type for binary large objects (blob).
It is attached for newly created blob in the default.
Non-administrative clients can read and write the blobs with this type.

\fBsepgsql_ro_blob_t\fP is a type for read-only binary large objects (blob).
Non-administrative clients cannot write the blobs with this type.

.SH "BACKUP and RESTORE"
\fI--enable-selinux\fP option in \fBsepg_dump\fP and \fBsepg_dumpall\fP enable to dump database image with security context. We can restore the dumped image using the standard \fIpg_restore\fP and so on.

.EX
Example)
$ sepg_dump -Ft -b --enable-selinux postgres | gzip -c > postgres.tgz
.EE

.SH AUTHOR	
This manual page was written by KaiGai Kohei <kaigai@kaigai.gr.jp>

.SH "SEE ALSO"

selinux(8), boolean(8)